Problem/Motivation
I've started porting Group's old policies to the new Access Policy API and realized that it would be a BC break to make them use the new core interfaces because someone might have extended my policies' classes and swapped them out in the service definitions. So I would be breaking their code and therefore have come up with an alternative (temporary) solution before I tag a new major release where I switch to core's API.
However, this has got me thinking. Extending an access policy, which is a tagged service, is actually something we should discourage, if not make impossible. We've had the issue before with the entity type handlers where only one module could ever swap out a handler because they were essentially all extending the same class and changing the same plugin definition entry. This made it so it was really hard if not impossible for multiple entity access modules to work together.
Group has fixed this problem by using a services-based handler system that was built with decorating in mind. Given how small the interface for an access policy is, I would also advocate for us changing the two access policy classes in core to final before we release it with 10.3. Or at the very least make them final in 11.0.
Keep in mind, you should never swap out an access policy with an extended class in contrib code because then we go back to the dark ages of incompatible access modules. Now is the chance to create a better ecosystem because the API is new. So contrib will always have to opt for decorators, or access policies of their own that make good use of the build and alter phase.
Project code, can still swap out the original class by decorating it with a high priority and then not calling the parent. So that avenue is still available when marking access policies as final, it's just far more clear from the code that this is not encouraged.
I intend to go into much more detail on this subject at DrupalCon Barcelona, but given the time issue I feel like we should probably tackle this before D10.3 or, less preferably, D11.
Steps to reproduce
N/A
Proposed resolution
Mark access policies as final and document this so contrib follows suit.
Remaining tasks
Mark the two policies in core as final.
User interface changes
N/A
API changes
Two policies in core become final.
Data model changes
N/A
Release notes snippet
N/A